EV not archiving due to memory error with events 3411 and 3310

[Leo_]

Every once in a while archiving stops and EV generates events 3411 and 3310. I have to restart the EV Admin service, which in turn restarts all other services, to get things working again. When I restart the EV admin service I receive a memory error from archivetask.exe which states:

The instruction at 0x00000000 referenced memory at 0x00000000". The memory could not be "written".
Click OK to terminate the program"

EV Event ID 3411:
An error has been reported by ConfigureMsgService.  It may be due to a problem contacting a Global Catalogue Server.
Exchange Server: MYEXCHANGESERVER
Mailbox: SMTP:EVSysAccount@MYDOMAIN.com
Error: MAPI_E_NETWORK_ERROR 0x80040115  

EV Event ID 3310:
There was a problem accessing a network service or resource.  The dispenser will re-queue the current item and sleep for 10 minute(s).
Task: Exchange Mailbox Archiving Task for MYEXCHANGESERVER
Internal Reference: Network connectivity issues (MAPI_E_NETWORK_ERROR)

This has been happening for almost two years. It doesn't happen a lot and is very random but when it does occur, its during the nightly scheduled archive run. Data Execution Prevention is turned on and I have tried adding archivetask.exe to the DEP exceptions list, but that did not help. I have run hardware diagnostics on my server but everything come back ok, especially memory, no problems.

Could it simply be a resource issue? The server is running 32bit Windows 2003 SP2 and is an HP Proliant DL385 G1 from 2006, it has 4 GB of RAM and Dual 2.6 ghz AMD Opteron 285 processors.

My PC at home is probably faster than this, but archive does work just fine and access to archives is OK. All except for this random memory error.

We will be upgrading to EV 10 so we'll have to replace this server with a 64bit one, but that's at least 6 months away and I would like to figure this out.

I am running EV 9.0.2, and yep, I have tried reinstalling the binaries. :)

Thank you in advance for any help you can give me.

[JesusWept3]

to really get to the bottom of the mapi network error, you would have to have some kind of network tracing on, be it NetMon or Wireshark or what not, to actually see what response the global catalog or Exchange server maybe giving for the failed request.

As for the memory cannot be written, you would really need to look at a dtrace and a memory dump on the exact time the isue occurs to see exactly what is going on, sometimes ive seen that in conjunction with anti virus and what not

It could however simply be a hung task that is reliant on another process, and when you do the restart of the services, this one task is attempting to call another module that was in memory but now disposted of

[Leo_]

The randomness of the error has been the biggest obstacle, because it sometimes goes months without occurring, meaning I woud have to log I every night right before midnight and run a dtrace for the next 8 hours and hope for the error to occur. That's a bit too tedious. I'll check with my server engineer to see if we can setup nightly automatic monitoring and comms between EV and exchange.

thanks

[JesusWept3 · Accepted solution]

yeah thats the huge problem, i mean you *could* set up a debugdiag to wait for that condition, but ebugdiag acn cause its own issues, same with tracing on a netmon, these onesy twosy every now and then problems are *the* hardest to troubleshoot.

best advice i can give is next time you get the errors, look at the GC and Exchange servers to see if anything was going on at that particular point in time (patching? defrags etc)